Using an ip range outside of those allowed for the local network?

Question

Information Security

Good afternoon,

I am currently engaged in technical audit in the company. The internal network is divided into several ranges, one of which is closed without Internet access. So this closed network has a range of 192.100.xxx.yyy, this range is not allowed for use in the local network.
What problems can arise from using this network? What if the border router receives a packet from an ip address from the Internet starting with 192.100. etc. Is it possible to get through NAT inside the network, or if a request is received from an ip address from a common subnet, then the answer will be sent directly. Can you please help with the risk assessment associated with the security and operation of such networks?

Answer 1

The maximum that the use of white addresses within the network threatens is that computers, when accessing resources on the Internet with addresses from the used range, will fall on their local resources.
If a packet with a similar source address enters the Internet, it will die there without a response. Most likely it will be beaten by its own provider. If suddenly it doesn’t kill and the packet reaches the addressee, then the answer will be sent to the real owner of this address, and not to you.
Most likely, such addressing is used to prevent access to the Internet, even if suddenly other protection mechanisms do not work.

Answer 2

Why waste time on risk assessments? Just take and change the addresses to typical ones for locales. And do not torture yourself and others

Answer 3

What problems can arise from using this network?

Theoretically, the unavailability of resources located at these addresses, because computers will access local IPs. Practically - you are hardly interested in Kenya :)
A normally configured router always has a rule - if a packet from the IP interface of the internal interface is on the external interface, kill it immediately.
This range was chosen most likely because of admin's laziness. I would just change to those allowed by RFC1918

Answer 4

the answer marked as a solution generally describes the risks well. I would add an increased risk of human error due to the manual configuration of the nodes. If security is critical, then regular network security audits are required, as well as automatic monitoring of critical node configurations. Conduct regular scans of each node from the outside and each segment of the network - from the inside. Usually held quarterly. You may need custom conditions to check that each segment is isolated from the Internet.